fix(gateway): apply session overrides in call_tool authorization

RoutingService::call_tool used resolve_feature_sets without session
context, so session-enabled servers passed list_servers but failed at
call time. Pass session_id and use get_tools_for_grants instead.

Signed-off-by: crimsonsunset <jsangio1@gmail.com>

Author: crimsonsunset

crates/mcpmux-gateway/src/mcp/handler.rs

@@ -793,6 +793,7 @@ impl ServerHandler for McpMuxGatewayHandler {
             .call_tool(
                 space_id,
                 &feature_set_ids,
+                session_id,
                 &params.name,
                 serde_json::to_value(params.arguments.unwrap_or_default()).unwrap_or_default(),
             )

crates/mcpmux-gateway/src/pool/routing.rs

@@ -187,6 +187,7 @@ impl RoutingService {
         &self,
         space_id: Uuid,
         feature_set_ids: &[String],
+        session_id: Option<&str>,
         tool_name: &str,
         arguments: Value,
     ) -> Result<ToolCallResult> {
@@ -199,10 +200,10 @@ impl RoutingService {
             .await?
             .ok_or_else(|| anyhow!("Tool '{}' not found", tool_name))?;
 
-        // 2. Check if the tool is allowed by grants
+        // 2. Check if the tool is allowed by grants (session overrides included)
         let allowed_features = self
             .feature_service
-            .resolve_feature_sets(&space_id_str, feature_set_ids)
+            .get_tools_for_grants(&space_id_str, feature_set_ids, session_id)
             .await?;
 
         info!(